Login via the API should only use POST